Detecting hardware changes
The application kudzu detects and configures new and/or changed hardware on a Linux system. When started, kudzu detects the current hardware and checks it against a database stored in /etc/sysconfig/hwconf, if one exists. It then determines if any hardware has been added or removed from the system. If new hardware is found, the user is prompted to configure the hardware. If hardware is expected but not found, the user can remove the configuration. Kudzu then updates the database in /etc/sysconfig/hwconf. If no previous database exists, kudzu attempts to determine what devices have already been configured by looking at /etc/modules.conf, /etc/sysconfig/network-scripts/, and /etc/X11/XF86Config.
The following are just a few of the pieces of hardware identified and stored in the hwconf database. The full listing can be obtained with the command kudzu -p. Shown in the following listing are a network interface card (NIC), a floppy drive, a CD-ROM drive, and a hard drive. By storing this information and comparing it with current values, any changes in the physical hardware can be found.
class: NETWORK bus: PCI detached: 0 device: eth driver: 3c59x desc: "3Com Corporation|3c905C-TX/TX-M [Tornado]" vendorId: 10b7 deviceId: 9200 subVendorId: 1028 subDeviceId: 00d5 pciType: 1 class: FLOPPY bus: MISC detached: 0 device: fd0 driver: unknown desc: "3.5" 1.44MB floppy drive" class: CDROM bus: SCSI detached: 0 device: scd0 driver: ignore desc: "Matshita CDRW/DVD UJDA740" host: 0 id: 0 channel: 0 lun: 0 generic: sg0 class: HD bus: IDE detached: 0 device: hda driver: ignore desc: "FUJITSU MHT2060AT" physical: 116280/16/63 logical: 7296/255/63
In this tutorial:
- UNIX and Linux Security
- Network and development tools
- UNIX/Linux as a poor target
- Open source issues
- Detecting hardware changes
- Disk partitioning
- Prepare for the eventual attack
- Controlling the Configuration
- Kernel configurations
- Kernel modules
- proc file system
- Operating UNIX Safely
- Uncommon services
- Processes controlling processes
- The chkconfig command
- Controlling users
- Chroot
- Encryption and certificates
- Hardening UNIX
- Packet filtering with iptables